GNCC GP5 IP Camera Multiple CVEs Analysis: U-Boot Root Injection & Static Key Leakage PoC

Vulnerability Overview This repository contains multiple unpatched Proof of Concept (PoC) exploits for the GNCC GP5 indoor camera, intended for educational purposes and defensive research. The vulnerabilities include: 1. Local Root via U-Boot Injection (CVE-2026-36175) 2. Failure of Encrypted Storage and Persistence (CVE-2026-36178) 3. Verbose UART Credential Leakage (CVE-2026-36174) 4. Dynamic Cloud Token Leakage (CVE-2026-36176) 5. OS-Level Security Flaws (CVE-2026-36180, CVE-2026-36178) Affected Scope Vendor: GNCC Model: GP5 (T23 Platform) Firmware Version: 7.1.76 Impact: May affect similar models utilizing the T23 architecture (e.g., GC2 variants) Remediation Coordinated Disclosure Timeline February 18, 2026: Initial vulnerability discovery; initial disclosure sent to vendor support. Contact made with MITRE CNA to assign CVEs. February 24, 2026: No response from the vendor. March 20, 2026: Multiple follow-up attempts ignored. April 4, 2026: 45-day no-response threshold reached. May 5, 2026: MITRE assigned 6 CVE IDs. Remediation Recommendations 1. Isolate Cameras: Place cameras on a dedicated VLAN with no outbound internet access. 2. Replace Hardware: Consider replacing hardware, as factory resets do not clear device keys, making resale of these units highly dangerous. Vendor Recommendations Disable U-Boot interrupts and implement verified boot. Implement per-device dynamic, rotatable keys and encrypt local storage. Fully erase the #mt4 configuration partition after a factory reset. Suppress sensitive UART output during boot. Replace MD5 with modern hashing algorithms and coordinate token verification with Osao. Proof of Concept (PoC) A. U-Boot Root Shell Injection 1. Connect via the UART interface (baud rate: 115200). 2. Interrupt the U-Boot sequence during power cycling. 3. Modify the bootloader to inject a shell: B. MTD4 Config Partition Extraction Once root access is obtained, the persistent configuration partition containing static RSA keys can be directly dumped: Coordinated Disclosure Timeline February 18, 2026: Initial vulnerability discovery; initial disclosure sent to vendor support. Contact made with MITRE CNA to assign CVEs. February 24, 2026: No response from the vendor. March 20, 2026: Multiple follow-up attempts ignored. April 4, 2026: 45-day no-response threshold reached. May 5, 2026: MITRE assigned 6 CVE IDs. Remediation Recommendations 1. Isolate Cameras: Place cameras on a dedicated VLAN with no outbound internet access. 2. Replace Hardware: Consider replacing hardware, as factory resets do not clear device keys, making resale of these units highly dangerous. Vendor Recommendations Disable U-Boot interrupts and implement verified boot. Implement per-device dynamic, rotatable keys and encrypt local storage. Fully erase the #mt4 configuration partition after a factory reset. Suppress sensitive UART output during boot. Replace MD5 with modern hashing algorithms and coordinate token verification with Osao.

Goal Reached Thanks to every supporter — we hit 100%!

GNCC GP5 IP Camera Multiple CVEs Analysis: U-Boot Root Injection & Static Key Leakage PoC

More from this source